Summary
[3.5.5-2.0.1]
- Replace upstream references [Orabug: 34340177]
- Update FIPS provider name [Orabug: 35824276]
[1:3.5.5-2]
- Fix CVE-2026-31790
Resolves: RHEL-161574
[1:3.5.5-1]
- Rebase to OpenSSL 3.5.5
Resolves: RHEL-122599
Resolves: RHEL-141987
Resolves: RHEL-142009
Resolves: RHEL-142022
Resolves: RHEL-142026
Resolves: RHEL-142030
Resolves: RHEL-142034
Resolves: RHEL-142038
Resolves: RHEL-142042
Resolves: RHEL-142046
Resolves: RHEL-142050
Resolves: RHEL-142054
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | openssl | 1:3.5.5-2.0.1.el10_2 |
| Oracle Linux · 10 | openssl-devel | 1:3.5.5-2.0.1.el10_2 |
| Oracle Linux · 10 | openssl-libs | 1:3.5.5-2.0.1.el10_2 |
| Oracle Linux · 10 | openssl-perl | 1:3.5.5-2.0.1.el10_2 |
Vulnerabilities 1
-
High 7.5
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…